Bug 1336020 - transferables should be arrays of objects, r=smaug

This commit is contained in:
Andrea Marchesini 2017-02-03 11:00:38 +01:00
parent 270f257d6b
commit 1fd70e0029
24 changed files with 109 additions and 128 deletions

View File

@ -9858,3 +9858,33 @@ nsContentUtils::GetContentPolicyTypeForUIImageLoading(nsIContent* aLoadingNode,
}
loadingPrincipal.forget(aLoadingPrincipal);
}
/* static */ nsresult
nsContentUtils::CreateJSValueFromSequenceOfObject(JSContext* aCx,
const Sequence<JSObject*>& aTransfer,
JS::MutableHandle<JS::Value> aValue)
{
if (aTransfer.IsEmpty()) {
return NS_OK;
}
JS::Rooted<JSObject*> array(aCx, JS_NewArrayObject(aCx, aTransfer.Length()));
if (!array) {
return NS_ERROR_OUT_OF_MEMORY;
}
for (uint32_t i = 0; i < aTransfer.Length(); ++i) {
JS::Rooted<JSObject*> object(aCx, aTransfer[i]);
if (!object) {
continue;
}
if (NS_WARN_IF(!JS_DefineElement(aCx, array, i, object,
JSPROP_ENUMERATE))) {
return NS_ERROR_OUT_OF_MEMORY;
}
}
aValue.setObject(*array);
return NS_OK;
}

View File

@ -2746,6 +2746,11 @@ public:
nsIPrincipal** aLoadingPrincipal,
nsContentPolicyType& aContentPolicyType);
static nsresult
CreateJSValueFromSequenceOfObject(JSContext* aCx,
const mozilla::dom::Sequence<JSObject*>& aTransfer,
JS::MutableHandle<JS::Value> aValue);
private:
static bool InitializeEventTable();

View File

@ -8807,27 +8807,20 @@ nsGlobalWindow::PostMessageMoz(JSContext* aCx, JS::Handle<JS::Value> aMessage,
void
nsGlobalWindow::PostMessageMoz(JSContext* aCx, JS::Handle<JS::Value> aMessage,
const nsAString& aTargetOrigin,
const Sequence<JS::Value>& aTransfer,
const Sequence<JSObject*>& aTransfer,
nsIPrincipal& aSubjectPrincipal,
ErrorResult& aError)
ErrorResult& aRv)
{
JS::Rooted<JS::Value> transferArray(aCx, JS::UndefinedValue());
if (!aTransfer.IsEmpty()) {
// The input sequence only comes from the generated bindings code, which
// ensures it is rooted.
JS::HandleValueArray elements =
JS::HandleValueArray::fromMarkedLocation(aTransfer.Length(),
aTransfer.Elements());
transferArray = JS::ObjectOrNullValue(JS_NewArrayObject(aCx, elements));
if (transferArray.isNull()) {
aError.Throw(NS_ERROR_OUT_OF_MEMORY);
return;
}
aRv = nsContentUtils::CreateJSValueFromSequenceOfObject(aCx, aTransfer,
&transferArray);
if (NS_WARN_IF(aRv.Failed())) {
return;
}
PostMessageMoz(aCx, aMessage, aTargetOrigin, transferArray,
aSubjectPrincipal, aError);
aSubjectPrincipal, aRv);
}
class nsCloseEvent : public Runnable {

View File

@ -982,7 +982,7 @@ public:
mozilla::ErrorResult& aError);
void PostMessageMoz(JSContext* aCx, JS::Handle<JS::Value> aMessage,
const nsAString& aTargetOrigin,
const mozilla::dom::Sequence<JS::Value>& aTransfer,
const mozilla::dom::Sequence<JSObject*>& aTransfer,
nsIPrincipal& aSubjectPrincipal,
mozilla::ErrorResult& aError);
int32_t SetTimeout(JSContext* aCx, mozilla::dom::Function& aFunction,

View File

@ -393,48 +393,34 @@ MessagePort::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)
void
MessagePort::PostMessage(JSContext* aCx, JS::Handle<JS::Value> aMessage,
const Sequence<JS::Value>& aTransferable,
const Sequence<JSObject*>& aTransferable,
ErrorResult& aRv)
{
// We *must* clone the data here, or the JS::Value could be modified
// by script
JS::Rooted<JS::Value> transferable(aCx, JS::UndefinedValue());
if (!aTransferable.IsEmpty()) {
// Here we want to check if the transerable object list contains
// this port. No other checks are done.
for (const JS::Value& value : aTransferable) {
if (!value.isObject()) {
continue;
}
MessagePort* port = nullptr;
nsresult rv = UNWRAP_OBJECT(MessagePort, &value.toObject(), port);
if (NS_FAILED(rv)) {
continue;
}
if (port == this) {
aRv.Throw(NS_ERROR_DOM_DATA_CLONE_ERR);
return;
}
// Here we want to check if the transerable object list contains
// this port.
for (uint32_t i = 0; i < aTransferable.Length(); ++i) {
JSObject* object = aTransferable[i];
if (!object) {
continue;
}
// The input sequence only comes from the generated bindings code, which
// ensures it is rooted.
JS::HandleValueArray elements =
JS::HandleValueArray::fromMarkedLocation(aTransferable.Length(),
aTransferable.Elements());
JSObject* array =
JS_NewArrayObject(aCx, elements);
if (!array) {
aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
MessagePort* port = nullptr;
nsresult rv = UNWRAP_OBJECT(MessagePort, object, port);
if (NS_SUCCEEDED(rv) && port == this) {
aRv.Throw(NS_ERROR_DOM_DATA_CLONE_ERR);
return;
}
}
transferable.setObject(*array);
JS::Rooted<JS::Value> transferable(aCx, JS::UndefinedValue());
aRv = nsContentUtils::CreateJSValueFromSequenceOfObject(aCx, aTransferable,
&transferable);
if (NS_WARN_IF(aRv.Failed())) {
return;
}
RefPtr<SharedMessagePortMessage> data = new SharedMessagePortMessage();

View File

@ -63,7 +63,7 @@ public:
void
PostMessage(JSContext* aCx, JS::Handle<JS::Value> aMessage,
const Sequence<JS::Value>& aTransferable,
const Sequence<JSObject*>& aTransferable,
ErrorResult& aRv);
void Start();

View File

@ -15,7 +15,7 @@ interface Client {
readonly attribute DOMString id;
[Throws]
void postMessage(any message, optional sequence<Transferable> transfer = []);
void postMessage(any message, optional sequence<object> transfer = []);
};
[Exposed=ServiceWorker]

View File

@ -16,7 +16,7 @@
Exposed=DedicatedWorker]
interface DedicatedWorkerGlobalScope : WorkerGlobalScope {
[Throws]
void postMessage(any message, optional sequence<any> transfer = []);
void postMessage(any message, optional sequence<object> transfer = []);
void close();

View File

@ -10,7 +10,7 @@
[Exposed=(Window,Worker,System)]
interface MessagePort : EventTarget {
[Throws]
void postMessage(any message, optional sequence<Transferable> transferable = []);
void postMessage(any message, optional sequence<object> transferable = []);
void start();
void close();

View File

@ -19,9 +19,8 @@ interface ServiceWorker : EventTarget {
attribute EventHandler onstatechange;
// FIXME(catalinb): Should inherit this from Worker.
[Throws]
void postMessage(any message, optional sequence<Transferable> transferable = []);
void postMessage(any message, optional sequence<object> transferable = []);
};
ServiceWorker implements AbstractWorker;

View File

@ -24,7 +24,6 @@ interface IID;
interface nsIBrowserDOMWindow;
interface nsIMessageBroadcaster;
interface nsIDOMCrypto;
typedef any Transferable;
// http://www.whatwg.org/specs/web-apps/current-work/
[PrimaryGlobal, LegacyUnenumerableNamedProperties, NeedResolve]
@ -85,7 +84,7 @@ typedef any Transferable;
any showModalDialog(DOMString url, optional any argument, optional DOMString options = "");
[Throws, CrossOriginCallable, NeedsSubjectPrincipal]
void postMessage(any message, DOMString targetOrigin, optional sequence<Transferable> transfer = []);
void postMessage(any message, DOMString targetOrigin, optional sequence<object> transfer = []);
// also has obsolete members
};

View File

@ -19,7 +19,7 @@ interface Worker : EventTarget {
void terminate();
[Throws]
void postMessage(any message, optional sequence<any> transfer = []);
void postMessage(any message, optional sequence<object> transfer = []);
attribute EventHandler onmessage;
};

View File

@ -80,7 +80,7 @@ ServiceWorker::GetScriptURL(nsString& aURL) const
void
ServiceWorker::PostMessage(JSContext* aCx, JS::Handle<JS::Value> aMessage,
const Sequence<JS::Value>& aTransferable,
const Sequence<JSObject*>& aTransferable,
ErrorResult& aRv)
{
if (State() == ServiceWorkerState::Redundant) {

View File

@ -64,7 +64,7 @@ public:
void
PostMessage(JSContext* aCx, JS::Handle<JS::Value> aMessage,
const Sequence<JS::Value>& aTransferable, ErrorResult& aRv);
const Sequence<JSObject*>& aTransferable, ErrorResult& aRv);
private:
// This class can only be created from ServiceWorkerInfo::GetOrCreateInstance().

View File

@ -191,7 +191,7 @@ private:
void
ServiceWorkerClient::PostMessage(JSContext* aCx, JS::Handle<JS::Value> aMessage,
const Sequence<JS::Value>& aTransferable,
const Sequence<JSObject*>& aTransferable,
ErrorResult& aRv)
{
WorkerPrivate* workerPrivate = GetCurrentThreadWorkerPrivate();
@ -199,18 +199,11 @@ ServiceWorkerClient::PostMessage(JSContext* aCx, JS::Handle<JS::Value> aMessage,
workerPrivate->AssertIsOnWorkerThread();
JS::Rooted<JS::Value> transferable(aCx, JS::UndefinedValue());
if (!aTransferable.IsEmpty()) {
JS::HandleValueArray elements =
JS::HandleValueArray::fromMarkedLocation(aTransferable.Length(),
aTransferable.Elements());
JSObject* array = JS_NewArrayObject(aCx, elements);
if (!array) {
aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
return;
}
transferable.setObject(*array);
aRv = nsContentUtils::CreateJSValueFromSequenceOfObject(aCx, aTransferable,
&transferable);
if (NS_WARN_IF(aRv.Failed())) {
return;
}
RefPtr<ServiceWorkerClientPostMessageRunnable> runnable =

View File

@ -92,7 +92,7 @@ public:
void
PostMessage(JSContext* aCx, JS::Handle<JS::Value> aMessage,
const Sequence<JS::Value>& aTransferable, ErrorResult& aRv);
const Sequence<JSObject*>& aTransferable, ErrorResult& aRv);
JSObject* WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) override;

View File

@ -532,7 +532,7 @@ public:
nsresult
ServiceWorkerPrivate::SendMessageEvent(JSContext* aCx,
JS::Handle<JS::Value> aMessage,
const Sequence<JS::Value>& aTransferable,
const Sequence<JSObject*>& aTransferable,
UniquePtr<ServiceWorkerClientInfo>&& aClientInfo)
{
AssertIsOnMainThread();
@ -543,17 +543,13 @@ ServiceWorkerPrivate::SendMessageEvent(JSContext* aCx,
}
JS::Rooted<JS::Value> transferable(aCx, JS::UndefinedHandleValue);
if (!aTransferable.IsEmpty()) {
JS::HandleValueArray elements =
JS::HandleValueArray::fromMarkedLocation(aTransferable.Length(),
aTransferable.Elements());
JSObject* array = JS_NewArrayObject(aCx, elements);
if (!array) {
return NS_ERROR_OUT_OF_MEMORY;
}
transferable.setObject(*array);
rv = nsContentUtils::CreateJSValueFromSequenceOfObject(aCx, aTransferable,
&transferable);
if (NS_WARN_IF(rv.Failed())) {
return rv.StealNSResult();
}
RefPtr<KeepAliveToken> token = CreateEventKeepAliveToken();
RefPtr<SendMesssageEventRunnable> runnable =
new SendMesssageEventRunnable(mWorkerPrivate, token, Move(aClientInfo));

View File

@ -82,7 +82,7 @@ public:
nsresult
SendMessageEvent(JSContext* aCx, JS::Handle<JS::Value> aMessage,
const Sequence<JS::Value>& aTransferable,
const Sequence<JSObject*>& aTransferable,
UniquePtr<ServiceWorkerClientInfo>&& aClientInfo);
// This is used to validate the worker script and continue the installation

View File

@ -145,7 +145,7 @@ SharedWorker::Close()
void
SharedWorker::PostMessage(JSContext* aCx, JS::Handle<JS::Value> aMessage,
const Sequence<JS::Value>& aTransferable,
const Sequence<JSObject*>& aTransferable,
ErrorResult& aRv)
{
AssertIsOnMainThread();

View File

@ -95,8 +95,7 @@ private:
// Only called by MessagePort.
void
PostMessage(JSContext* aCx, JS::Handle<JS::Value> aMessage,
const Sequence<JS::Value>& aTransferable,
ErrorResult& aRv);
const Sequence<JSObject*>& aTransferable, ErrorResult& aRv);
};
END_WORKERS_NAMESPACE

View File

@ -3077,11 +3077,10 @@ WorkerPrivateParent<Derived>::ForgetMainThreadObjects(
template <class Derived>
void
WorkerPrivateParent<Derived>::PostMessageInternal(
JSContext* aCx,
JS::Handle<JS::Value> aMessage,
const Sequence<JS::Value>& aTransferable,
ErrorResult& aRv)
WorkerPrivateParent<Derived>::PostMessageInternal(JSContext* aCx,
JS::Handle<JS::Value> aMessage,
const Sequence<JSObject*>& aTransferable,
ErrorResult& aRv)
{
AssertIsOnParentThread();
@ -3093,20 +3092,11 @@ WorkerPrivateParent<Derived>::PostMessageInternal(
}
JS::Rooted<JS::Value> transferable(aCx, JS::UndefinedValue());
if (!aTransferable.IsEmpty()) {
// The input sequence only comes from the generated bindings code, which
// ensures it is rooted.
JS::HandleValueArray elements =
JS::HandleValueArray::fromMarkedLocation(aTransferable.Length(),
aTransferable.Elements());
JSObject* array =
JS_NewArrayObject(aCx, elements);
if (!array) {
aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
return;
}
transferable.setObject(*array);
aRv = nsContentUtils::CreateJSValueFromSequenceOfObject(aCx, aTransferable,
&transferable);
if (NS_WARN_IF(aRv.Failed())) {
return;
}
RefPtr<MessageEventRunnable> runnable =
@ -3149,7 +3139,7 @@ template <class Derived>
void
WorkerPrivateParent<Derived>::PostMessage(
JSContext* aCx, JS::Handle<JS::Value> aMessage,
const Sequence<JS::Value>& aTransferable,
const Sequence<JSObject*>& aTransferable,
ErrorResult& aRv)
{
PostMessageInternal(aCx, aMessage, aTransferable, aRv);
@ -5722,25 +5712,17 @@ void
WorkerPrivate::PostMessageToParentInternal(
JSContext* aCx,
JS::Handle<JS::Value> aMessage,
const Sequence<JS::Value>& aTransferable,
const Sequence<JSObject*>& aTransferable,
ErrorResult& aRv)
{
AssertIsOnWorkerThread();
JS::Rooted<JS::Value> transferable(aCx, JS::UndefinedValue());
if (!aTransferable.IsEmpty()) {
// The input sequence only comes from the generated bindings code, which
// ensures it is rooted.
JS::HandleValueArray elements =
JS::HandleValueArray::fromMarkedLocation(aTransferable.Length(),
aTransferable.Elements());
JSObject* array = JS_NewArrayObject(aCx, elements);
if (!array) {
aRv = NS_ERROR_OUT_OF_MEMORY;
return;
}
transferable.setObject(*array);
aRv = nsContentUtils::CreateJSValueFromSequenceOfObject(aCx, aTransferable,
&transferable);
if (NS_WARN_IF(aRv.Failed())) {
return;
}
RefPtr<MessageEventRunnable> runnable =

View File

@ -250,7 +250,7 @@ private:
void
PostMessageInternal(JSContext* aCx, JS::Handle<JS::Value> aMessage,
const Sequence<JS::Value>& aTransferable,
const Sequence<JSObject*>& aTransferable,
ErrorResult& aRv);
nsresult
@ -361,7 +361,7 @@ public:
void
PostMessage(JSContext* aCx, JS::Handle<JS::Value> aMessage,
const Sequence<JS::Value>& aTransferable,
const Sequence<JSObject*>& aTransferable,
ErrorResult& aRv);
void
@ -1125,18 +1125,17 @@ public:
void
PostMessageToParent(JSContext* aCx,
JS::Handle<JS::Value> aMessage,
const Sequence<JS::Value>& aTransferable,
const Sequence<JSObject*>& aTransferable,
ErrorResult& aRv)
{
PostMessageToParentInternal(aCx, aMessage, aTransferable, aRv);
}
void
PostMessageToParentMessagePort(
JSContext* aCx,
JS::Handle<JS::Value> aMessage,
const Sequence<JS::Value>& aTransferable,
ErrorResult& aRv);
PostMessageToParentMessagePort(JSContext* aCx,
JS::Handle<JS::Value> aMessage,
const Sequence<JSObject*>& aTransferable,
ErrorResult& aRv);
void
EnterDebuggerEventLoop();
@ -1457,7 +1456,7 @@ private:
void
PostMessageToParentInternal(JSContext* aCx,
JS::Handle<JS::Value> aMessage,
const Sequence<JS::Value>& aTransferable,
const Sequence<JSObject*>& aTransferable,
ErrorResult& aRv);
void

View File

@ -517,7 +517,7 @@ DedicatedWorkerGlobalScope::WrapGlobalObject(JSContext* aCx,
void
DedicatedWorkerGlobalScope::PostMessage(JSContext* aCx,
JS::Handle<JS::Value> aMessage,
const Sequence<JS::Value>& aTransferable,
const Sequence<JSObject*>& aTransferable,
ErrorResult& aRv)
{
mWorkerPrivate->AssertIsOnWorkerThread();

View File

@ -212,7 +212,7 @@ public:
void
PostMessage(JSContext* aCx, JS::Handle<JS::Value> aMessage,
const Sequence<JS::Value>& aTransferable,
const Sequence<JSObject*>& aTransferable,
ErrorResult& aRv);
void